Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-45qg-252v-3f7p
No affected components available
A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit's clean-html sanitizer.
The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign (SVG/MathML) elements preserve their original-case node names — an SVG script reports "script", not "SCRIPT" — so the default denyTags list (which includes script) did not match it. The script therefore survived in the editor value and serialized output, where it could execute when the content was loaded back into a page or editor.
Proof of concept
<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 124 124">
<rect width="124" height="124" rx="24" fill="#000000"></rect>
<script type="text/javascript">alert(document.domain);</script>
</svg>
Load the payload into the editor (e.g. via source mode) and the <script> is preserved in editor.value and executes.
Impact
Stored / DOM cross-site scripting. An application that persists editor output and later renders or re-opens it in Jodit can have attacker-supplied script run in a victim's (e.g. an administrator's) authenticated browser context.
Patch
Fixed in 4.13.6: the deny/allow lookup now normalises the tag name to upper case before matching, so a foreign namespace can no longer bypass the filter, while allowTags is still honoured.
Workaround
Upgrade to 4.13.6 or later. Server-side sanitization of stored HTML mitigates in the interim.
Credit
Reported by Roman Kis (@CrownKingClown).
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights.
Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard